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DETAILED ACTION 
Response to Amendment 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.114. Applicant's submission filed on 1/27/2006 has been entered. 

2. Applicant's amendments to claims 1-48 are acknowledged. Consequently, claims 1-48 
are canceled. Claims 49 - 66 have been added and currently pending. 

Claim Objections 

3. Claims 62 - 66 are objected to under 37 CFR 1.75(c), as being of improper dependent 
form for failing to further limit the subject matter of a previous claim. Applicant is required to 
cancel the claim(s), or amend the claim(s) to place the claim(s) in proper dependent form, or 
rewrite the claim(s) in independent form. 

Applicant claims an apparatus in claim 61, and there are no such claims 17 - 20 in the current 
version of claims. However, applicant claims in claims 62 - 66 that they are depended on claims 
17 - 20, and 17 respectively. The Examiner assumes that claims 62 - 66 are depended on claim 
61 - 64, 61 respectively. A correction is required. 

Claim Rejections - 35 USC §101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 
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5. Claims 49 - 60 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non- statutory subject matter. 

6. In the present case, although claims 49 - 60 recite an abstract idea of a method for 
managing a database system, however, the language of the claims raise a question as to whether 
the claim is directed merely to an abstract idea which would result in a practical application 
producing a concrete, useful, and tangible result to form the basis of statutory subject matter 
under 35 U.S.C. 101 . The claim invention would not provide any "tangible result" in the 
situation of "if the user is a sensitive user, and if the command is received from a normal 
administrator, disallowing the administrative function 55 . In another words, since the claimed 
invention, as a whole, is not produce a concrete, useful, and tangible result as explained above, 
these claims only constitute an idea and does not apply, involve, use, or advance the 
technological arts, thus, it is deems to be directed to non- statutory subject matter. 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

8. Claims 49 - 50, 54 - 56, 60 - 62, 66 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over D. Richard Kuhn (U.S. 6,023,765) in view of Sweet et al (U.S. 2002/0031230 
Al). 

♦ As per claims 49, 55, 61 
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Kuhn discloses a method/a computer-readable storage medium (corresponds to MLS system, col. 
4, lines 25 - 30) and an apparatus for managing a database system comprising: 

- "Receiving a command to perform an administrator function involving a user within the 
database system" (See Fig. 3, col. 7, lines 65 - 66). Any type of users can make the 
command in the privileged classes (Fig. 1, element 10). "Involving a user within the 
database system" corresponds to a object or documents or employ resources (col. 4, lines 
53 - 56). 

- "Determining if the user is a sensitive user who is empowered to access sensitive data in 
the database system". In this case, the Examiner interpret the phrase "the user is a 
sensitive user who is empowered to access sensitive data in the database system" as a 
"document or employ resource" that are protected in the system. The object is attached 
label such as "CONFIDENTIAL, SECRET, TOP SECRET" (col.6, lines 53 - 55). Kuhn 
teaches that in order to access to the object, it must determine the sensitivity level of the 
information (Col. 10, lines 10-12). 

- " If the user is not a sensitive user, and if the command is received from a normal 
database administrator for the database system, allowing the administrative function to 
proceed" (See col. 7, lines 18 - 24, 65 - col. 8, lines 4). Kuhn teaches that the system 
would only allow the use access to the object when the security levels equal or less than 
his/her own clearance level using the mapping. Therefore, if the document is not sensitive 
(not a sensitive user) such as having labeled "confidence", and the user is having a 
"confidence" level (normal administrator), then the systems will "allowing the 
administrative function to proceed". 
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- " If the user is a sensitive user, and if the command is received from a normal 
administrator, disallowing the administrative function" (See col. 7, lines 18 - 24, 65 - 
col. 8, lines 4). As discussed above, Kuhn teaches that the system would only allow the 
use access to the object when the security levels equal or less than his/her own clearance 
level using the mapping. Therefore, if the document is sensitive (a sensitive user) such as 
having labeled "top secret", and the user is having a "confidence" level (normal . 
administrator), then the systems will "disable the administrative function to proceed". 

- " If the user is a sensitive user, and if the command is received from a security officer 
who is empowered to perform administrative functions for sensitive users, allowing the 
administrative function to proceed". Again, by applying the same test above, the system 
would allow the security officer to perform the administrative function since the security 
officer is the highest level in the database system. 

- " A command receiving mechanism configured to receive a command" corresponds to 
the external system 24 (See Fig. 2, element 24). 

Kuhn does not clearly teach that the database system has a plurality of administrators, and at 
least one of the pluralities of administrators is a security officer who can perform administrative 
functions on sensitive objects. 

However, Sweet, on the other hand, discloses a security system that comprises: 

- " Plurality of administrators" page 7, paragraph 0090. 
"The sensitive object" See page 6, paragraph 008 1 . 

- " Wherein at least one of the plurality of administrators is a security officer who can 
perform administrative functions on sensitive objects" See page 7, paragraph 0090. 
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- " Wherein an administrator in the plurality of administrators who is not a security officer 
cannot become a sensitive user and thereby obtain access to sensitive objects indirectly 55 
See page 7, paragraph 0091. Wherein, "an administrator in the plurality of administrators 
who is not a security officer 55 can be a normal administrator in domain 125, who is 
responsible for the configuration and management only. 

"If the object is not a sensitive object, and if the command is received from an 
administrator who is not a security officer; allowing the administrative function to 
proceed 55 page 7, paragraph 0090 - 0091, 0152. 

- "If the object is a sensitive object, and if the command is received from an administrator 
who is not a security officer, disallowing the administrative function 55 page 7, paragraph 
0090-0091,0165. 

As discussed above, the Sweet discloses a hierarchical administrative group according to 
different levels of administrative. tasks (see page 3 paragraph 0035 of Sweet), and Kuhn 
teaches that depending on user privileges, the system will allow the user to access to the 
object (See col. 7, lines 18 - 24, 65 - col. 8, lines 4 of Kuhn). 
It would have been obvious to one with ordinary skill in the art at the time the invention was 
made to apply the teaching of Sweet into the system of Kuhn because both invention were 
available and the teaching of Sweet provides secure electronic access to the system; the 
combination would protect the database more secure by using different administrator levels so 
that an administrator in the plurality of administrators who is not a security officer (using 
administrator group in Sweet) cannot perform administrative functions on sensitive object (using 
Kuhn invention). 
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♦ As per claims 50, 56, 62, Kuhn and Sweet disclose: 

- "A request to perform an operation" corresponds to "a command to perform an 
administrative function" See Fig. 3, col.7, lines 65 - 66 of Kuhn. 

- " If the data item is a sensitive data item containing sensitive information and if the 
request is received from a sensitive user who is empowered to access sensitive data, 
allowing the operation to proceed if the sensitive user has access rights to the sensitive 
data item" The Examiner in this case will interpret the "data item" as "document" in 
Kuhn reference. Again, by applying the same test above, the system would allow the 
sensitive user who is empowered to access sensitive data to perform the administrative 
function since the sensitive user is the highest level in the database system (See col. 7, 
lines 18 - 24, 65 - col. 8, lines 4 of Kuhn). 

" If the data item is a sensitive data item and the request is received from a user who is 
not a sensitive user, disallowing the operation" (See col. 7, lines 18 - 24, 65 - col. 8, lines 
4). As discussed above, Kuhn teaches that the system would only allow the use access to 
the object when the security levels equal or less than his/her own clearance level using 
the mapping. Therefore, if the document is sensitive (a sensitive data) such as having 
labeled "top secret", and the user is having a "confidence" level (not a sensitive user), 
then the systems will "disable the administrative function to proceed". 

♦ As per claims 54, 60, 66, Kuhn and Sweet disclose: 

- " Wherein if the user is not a sensitive user, and if the command to perform the 
administrative function is received from a security officer, the method further comprises 
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allowing the security officer to perform the administrative function on the user" See col. 
7, lines 18 - 24, 65 - col. 8, lines 4 of Kuhn. 

9. Claims 51 - 53, 57 - 59, 63 - 66 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over D. Richard Kuhn (U.S. 6,023,765) in view of Sweet et al (U.S. 2002/0031230 
Al) as applied to claims 49 - 50 above, and further in view of Minear et al (U.S. 5,983,350). 
♦ As per claim 51 - 53,57- 59, 63 - 66, Kuhri and Sweet disclose: 
The combination of Kuhn and Sweet fail to disclose: 

" Wherein if the data item is* a sensitive data item, if the operation is allowed to proceed, 
and if the operation involves retrieval of the data item, the method further comprises 
decrypting the data item using an encryption key after the data item is retrieved". 
However, this is a well-known technique in the art to protect the data when transferring in the 
network. Minear provided an example of it. Minear teaches a method for securely transferring 
information in the network (col. 1, lines 8-11, Minear) comprising the decrypting/encrypting 
data (col. 2, lines 52 - 64, Minear). Minear also teaches that the encryption key is stored in a 
table ( col. 7, lines 29 - 35, Minear). 

It would have been obvious to one with ordinary skill in the art at the time the invention was 
made to apply the teaching of Minear into the combination of Kuhn/Sweet because the 
combination would protect the data more secure and prevent the unauthorized user to access the 
data. 

Response to Arguments 



Application/Control Number: 09/741,680 



Page 9 



Art Unit: 2161 

10. Applicant's arguments with respect to claims 49 - 66 have been considered but are moot 
in view of the new ground(s) of rejection. 



1 1 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to CamLinh Nguyen whose telephone number is (571) 272-4024. 
The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, GAFFIN JEFFREY A can be reached on (571) 272-4146. The fax phone number for 
the organization where this application or proceeding is assigned is 571 - 273- 8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Conclusion 
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